The organization's top management should establish an AI policy that is appropriate for the organization's purpose and the nature of its AI systems. This policy should provide a framework for setting AI objectives and include commitments to fulfill applicable AI-related requirements (e.g., legal, regulatory, ethical) and to continually improve the AI management system. The policy should be documented, maintained, and made available to all relevant personnel within the organization. Where appropriate, it should also be accessible to other interested parties and refer to other relevant organizational policies.

The organization should establish a process for periodic review and validation of its AI policy. This review should assess the policy's ongoing relevance, adequacy, and effectiveness in managing AI-related risks and supporting ethical AI practices. Reviews should also be triggered by significant changes in the organization's AI systems, operational context, or relevant regulations to ensure the policy remains up-to-date and appropriate. The review process should include clear criteria for assessing the policy's suitability and documented outcomes.

The organization should assess how the objectives for AI systems intersect with, or may be influenced by, other existing policies (e.g., quality, security, privacy, environmental policies). This assessment helps to ensure consistency and avoid conflicts between AI system development/deployment and the organization's broader strategic goals and commitments.